# anomaly detection with gaussian mixture models

I am new to the topic, and I am trying to understand how it is possible to perform anomaly detection by using gaussian mixture models. Could you please give me some hints about literature on the topic?

• Basically, small cluster size (ideally with 1 point inside) = outlier. For further details you need to elaborate a bit more on the data you work with. – German Demidov Sep 22 '16 at 13:59
• Small cluster size would be a singularity and does not neccesarily signifiy an outlier but rather a suboptimal result of EM for GMM. (which happens often) – Nikolas Rieble Sep 22 '16 at 14:35

## 1 Answer

Gaussian Mixture Models allow assigning a probability to each datapoint of beeing created by one of k gaussian distributions.

These are normalized to sum up to one, allowing interpretation as "Which cluster is most probably responsible for this datapoint?"

If you do not normalize, you have absolute probabilities which estimate how probable a point is - given a specific gaussian mixture model.

Then you can simply define an outlier such as: If p < 0.05 for each cluster, then the point is an outlier.

Yet be warned, the expectation maximization algorithm for gaussian mixture models - which you will need to get best parameters for your gaussian mixture model - is not very robust and tends to find suboptimal solution.

For reading more - especially unterstanding more - I recommend Bishop: Pattern Recognition and Machine Learning

• Thanks a lot. I am trying to implement it in python, by using scikitlearn and its EM function, based on Expectation-Maximization algorithm. It returns the posterior probabilities of the sample to belong to each cluster, is it the p you mean in your comment? – lapally Sep 23 '16 at 15:48
• No. The posterior probabilites of sklearn implementation is the responsebility of each cluster for single observation. Yet you can use this implementation for outlier detection. Therefore, you will fit a gaussian mixture model and then use the attributes of the GMM object (gmm.means_ , gmm.covars_ ) to calculate the probability density function for a single observation for each cluster. – Nikolas Rieble Sep 24 '16 at 10:18